Re: [Full-disclosure] [NANOG] IOS rootkits

[n3td3v <xploitable@xxxxxxxxx>]

On Tue, May 20, 2008 at 11:53 PM, Dr. J Swift <fdiscsplat@xxxxxxxxx> wrote:
> Mr. Wallace,
>
> In your rush to reply, you failed to actually respond to my post.
>
> Again, you use the technique of "Supressed Evidence" to forcefully
> reply while not actually responding to the point that was made.
>
> On Tue, May 20, 2008 at 6:31 PM, n3td3v <xploitable@xxxxxxxxx> wrote:
>> On Tue, May 20, 2008 at 11:25 PM, Dr. J Swift <fdiscsplat@xxxxxxxxx> wrote:
>>> Mr. Wallace,
>>>
>>> 1.  HD Moore long ago released a kit that could be used to rootkit
>>> Cisco boxes.  This is an obvious statement of fact.
>>> 2.  In-the-wild Cisco rootkits have been known to non-eponymous
>>> security researchers for a considerable time.
>>> 3.  You have said that HD More is a global threat.
>>> 4.  You have repeatedly defamed/slandered/libeled HD Moore among a
>>> global community of peers and coworkers.
>>>
>>> I am providing this opportunity for you to show a correlation between
>>> the current existence of rootkits for Cisco systems and the current
>>> existence of tools from HD Moore.
>>
>>
>> So can you guarantee the HD Moore's of the world won't work out how to
>> do Cisco rootkits after the EUSecWest presentation and won't release a
>> tool to the mailing lists?
> No guarantee is required.  Rootkits and tools already exist.

If you can't guarantee it, then the presentation shouldn't go ahead.

>>
>> You are delusional if you think this presentation won't lead to
>> someone releasing a tool to the script kids, the presentation can't go
>> ahead.
> 1.  It is obvious to security researchers, Mr. Wallace, that a number
> of such tools already exist.
> 2.  There exist a number of Cisco rootkits that are known to security
> researchers.
> Mr. Wallace, I am sure that you are thoroughly versed in these things
> because of your standing in the security community and your
> affiliation with Global Intelligence Services.  So, why do you
> repeatedly cast aspersions on HD Moore?
>

Because in my opinion it is highly skilled people like HD Moore who
would release a tool for Cisco rootkits after watching or reading the
presentation.

All the best,

n3td3v

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/